Re: [kitten] [IANA #748877] please review SASL-SCRAM-256

[Simon Josefsson <[e-mail]>]

Hi again,

I haven't seen anyone disagree with my interpretation that the
registration policy for new SCRAM-* mechanisms are "IETF Review", which
requires an RFC.  Therefor, I will suggest to IANA that they turn down
the registration request until that has been fulfilled.

Personally, I see nothing wrong with registering this, given that a
GSS-API OID is allocated at the same time.

/Simon

You wrote:

> Dear all,
> 
> We have received a request to register the SCRAM-SHA-256 and
> SCRAM-SHA-256-PLUS mechanism.  According to my understanding of what
> RFC 5802 section 10 says, the registration process is "IETF Review"
> http://tools.ietf.org/html/rfc5226#page-11 which requires an RFC, but
> I may be mistaken.  Anyway, suggestions on how to deal with the
> registration request is appreciated.
> 
> Having a SCRAM with SHA-256 seems like a fairly non-controversial
> thing to me.  There are interop aspects though, and the utility of
> defining a lot of variants could be debated.  I would like to see a
> GSS-API OID registered at the same time for any new SCRAM-SHA-* family
> member, but it seems we forgot to write a policy to make sure that
> happens.  Other thoughts?
> 
> /Simon
> 
> You wrote:
> 
> > Dear Simon,
> > 
> > IANA has received a request from Tony Hansen ([e-mail]) for two
> > new registrations in the SASL Mechanisms registry at
> > http://www.iana.org/assignments/sasl-mechanisms. 
> > 
> > Please let us know when the two-week review period on [e-mail]
> > is complete.
> > 
> > thanks,
> > 
> > Amanda Baber
> > IANA Request Specialist
> > ICANN
> > 
> > ===
> > 
> > IANA, please register the following:
> > 
> > To: [e-mail]
> > Subject: Registration of a new SASL mechanism SCRAM-SHA-256
> > 
> > SASL mechanism name (or prefix for the family): SCRAM-SHA-256
> > Security considerations: Section 7 of [RFC5802]
> > Published specification (optional, recommended): [RFC5802]
> > Person & email address to contact for further information:
> > IETF SASL WG <[e-mail]>
> > Intended usage: COMMON
> > Owner/Change controller: IESG <[e-mail]>
> > Note:
> > 
> > To: [e-mail]
> > Subject: Registration of a new SASL mechanism SCRAM-SHA-256-PLUS
> > 
> > SASL mechanism name (or prefix for the family): SCRAM-SHA-256-PLUS
> > Security considerations: Section 7 of [RFC5802]
> > Published specification (optional, recommended): [RFC5802]
> > Person & email address to contact for further information:
> > IETF SASL WG <[e-mail]>
> > Intended usage: COMMON
> > Owner/Change controller: IESG <[e-mail]>
> > Note:
> > 
>